Don't send cookie unless needed for validation

The validation functionality is super cool! But once you use that filter, it will automatically send a cookie. This change will only send the cookie if the cookie was previously set or when Keep() has been called.

I started off making a ValidationFilterSimple which worked the same, but I believe this combined version is cleaner. Feel free to give any guidance for improvements. :)